sorcier/NexusPBX
1
0 Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

Fix: usedns=no in fail2ban, exact quoted host regex for asterisk, and timeout 2 on all fail2ban-client calls

Browse Source
This commit is contained in:
sorcier committed 2026-11-02 08:56:27 +01:00
1 parent aba35dbe3a
commit 8bbeb9caae
3 files changed
+48 -11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/FirewallManager.php
+10 -9
View File
@@ -73,8 +73,8 @@ class FirewallManager
$settings = self::getSettings();
// 1. Détection service Fail2ban
exec('sudo /usr/bin/fail2ban-client ping 2>&1', $pingOut, $pingCode);
// 1. Détection service Fail2ban (avec timeout strict de 2s anti-blocage)
exec('timeout 2 sudo /usr/bin/fail2ban-client ping 2>&1', $pingOut, $pingCode);
$isRunning = ($pingCode === 0 && str_contains(implode(' ', $pingOut), 'Server replied: pong'));
$jails = [];
@@ -82,7 +82,7 @@ class FirewallManager
$totalBannedCount = 0;
if ($isRunning) {
exec('sudo /usr/bin/fail2ban-client status 2>&1', $statOut);
exec('timeout 2 sudo /usr/bin/fail2ban-client status 2>&1', $statOut);
$statStr = implode("\n", $statOut);
// Extraction des prisons actives
@@ -138,7 +138,7 @@ class FirewallManager
$unbannedFrom = [];
if ($jail !== '' && $jail !== 'all') {
$cmd = "sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " unbanip " . escapeshellarg($ip) . " 2>&1";
$cmd = "timeout 2 sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " unbanip " . escapeshellarg($ip) . " 2>&1";
exec($cmd, $out, $code);
if ($code === 0) {
$unbannedFrom[] = $jail;
@@ -146,7 +146,7 @@ class FirewallManager
} else {
// Débannir de toutes les prisons connues
foreach (['asterisk', 'nexus-web', 'sshd'] as $j) {
$cmd = "sudo /usr/bin/fail2ban-client set " . escapeshellarg($j) . " unbanip " . escapeshellarg($ip) . " 2>&1";
$cmd = "timeout 2 sudo /usr/bin/fail2ban-client set " . escapeshellarg($j) . " unbanip " . escapeshellarg($ip) . " 2>&1";
exec($cmd, $out, $code);
if ($code === 0) {
$unbannedFrom[] = $j;
@@ -175,7 +175,7 @@ class FirewallManager
}
$jail = trim($jail) ?: 'asterisk';
$cmd = "sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " banip " . escapeshellarg($ip) . " 2>&1";
$cmd = "timeout 2 sudo /usr/bin/fail2ban-client set " . escapeshellarg($jail) . " banip " . escapeshellarg($ip) . " 2>&1";
exec($cmd, $out, $code);
@unlink('/tmp/nexus_fw_status_cache.json');
@@ -253,8 +253,8 @@ class FirewallManager
$adminPort
);
// 3. Rechargement de Fail2ban
exec('sudo /usr/bin/fail2ban-client reload 2>&1', $f2bOut, $f2bCode);
// 3. Rechargement de Fail2ban (timeout 3s)
exec('timeout 3 sudo /usr/bin/fail2ban-client reload 2>&1', $f2bOut, $f2bCode);
// 4. Mise à jour de la configuration Nginx
self::applyNginxConfig($adminPort, $strictPort80);
@@ -291,6 +291,7 @@ ignoreip = {$whitelist}
findtime = {$sipFindTime}
bantime = {$sipBanTime}
maxretry = {$sipMaxRetry}
usedns = no
[sshd]
enabled = true
@@ -492,7 +493,7 @@ EOF;
private static function getJailDetails(string $jail): array
{
exec('sudo /usr/bin/fail2ban-client status ' . escapeshellarg($jail) . ' 2>&1', $out);
exec('timeout 2 sudo /usr/bin/fail2ban-client status ' . escapeshellarg($jail) . ' 2>&1', $out);
$str = implode("\n", $out);
$currentlyFailed = 0;